diff --git a/source/smb_server/reply.c b/source/smb_server/reply.c
index 615dd692a14..8fd97df44a9 100644
--- a/source/smb_server/reply.c
+++ b/source/smb_server/reply.c
@@ -2320,6 +2320,7 @@ void reply_ntcreate_and_X(struct smbsrv_request *req)
 void reply_ntcancel(struct smbsrv_request *req)
 {
 	/* NOTE: this request does not generate a reply */
+	req_signing_no_reply(req);
 	ntvfs_cancel(req);
 	req_destroy(req);
 }
diff --git a/source/smb_server/signing.c b/source/smb_server/signing.c
index 8a3fd10095c..c397963f388 100644
--- a/source/smb_server/signing.c
+++ b/source/smb_server/signing.c
@@ -130,13 +130,21 @@ static void req_signing_alloc_seq_num(struct smbsrv_request *req)
 {
 	req->seq_num = req->smb_conn->signing.next_seq_num;
 
-	/* TODO: we need to handle one-way requests like NTcancel, which 
-	   only increment the sequence number by 1 */
 	if (req->smb_conn->signing.signing_state != SMB_SIGNING_OFF) {
 		req->smb_conn->signing.next_seq_num += 2;
 	}
 }
 
+/*
+  called for requests that do not produce a reply of their own
+*/
+void req_signing_no_reply(struct smbsrv_request *req)
+{
+	if (req->smb_conn->signing.signing_state != SMB_SIGNING_OFF) {
+		req->smb_conn->signing.next_seq_num--;
+	}
+}
+
 /***********************************************************
  SMB signing - Simple implementation - check a MAC sent by client
 ************************************************************/